-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathssh-hardening.yaml
165 lines (134 loc) · 6.13 KB
/
ssh-hardening.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
- hosts: all
become: yes
become_user: root
become_method: sudo
remote_user: sys-admin
vars:
syslog_facility: AUTHPRIV
log_level: INFO
tasks:
- name: Get the Active IP address
shell: hostname -I|cut -d " " -f1
register: get_ip
- name: get ssh version
shell: rpmquery openssh-server |cut -d "-" -f 3|cut -c 1-3
register: get_ssh_ver
- set_fact:
IP={{ get_ip.stdout }}
SSHVER={{ get_ssh_ver.stdout }}
- name: Change SSH daemon configuration
lineinfile:
line: "{{ item.line }}"
regexp: "{{ item.regexp }}"
path: /etc/ssh/sshd_config
loop:
- line: 'AddressFamily inet'
regexp: '^(#)?AddressFamily'
- line: 'ListenAddress {{IP}}'
regexp: '^(#)?ListenAddress'
- line: 'SyslogFacility {{ syslog_facility }}'
regexp: '^(#)?SyslogFacility'
- line: 'LogLevel {{ log_level }}'
regexp: '^(#)?LogLevel'
- line: 'PermitRootLogin no'
regexp: '^(#)?PermitRootLogin'
- line: 'MaxAuthTries 3'
regexp: '^(#)?MaxAuthTries'
- line: 'HostbasedAuthentication no'
regexp: '^(#)?HostbasedAuthentication'
- line: 'IgnoreRhosts no'
regexp: '^(#)?IgnoreRhosts'
- line: 'PermitEmptyPasswords no'
regexp: '^(#)?PermitEmptyPasswords'
- line: 'PasswordAuthentication yes'
regexp: '^(#)?PasswordAuthentication'
- line: 'X11Forwarding no'
regexp: '^(#)?X11Forwarding'
- line: 'PermitUserEnvironment no'
regexp: '^(#)?PermitUserEnvironment'
- line: 'ClientAliveInterval 900'
regexp: '^(#)?ClientAliveInterval'
- line: 'ClientAliveCountMax 0'
regexp: '^(#)?ClientAliveCountMax'
- line: 'UseDNS no'
regexp: '^(#)?UseDNS'
# - line: 'UsePAM yes'
# regexp: '^(#)?UsePAM'
- line: 'Banner /etc/issue.net'
regexp: '^(#)?Banner'
- line: 'Subsystem sftp /usr/libexec/openssh/sftp-server -f {{ syslog_facility }} -l {{ log_level }}'
regexp: '^(#)?Subsystem'
- name: Set secure HostKeyAlgorithms
lineinfile:
path: /etc/ssh/sshd_config
insertafter: '^#RekeyLimit default none'
line: 'HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256'
state: present
- name: Set secure KexAlgorithms
lineinfile:
path: /etc/ssh/sshd_config
insertafter: '^#RekeyLimit default none'
line: 'KexAlgorithms [email protected],curve25519-sha256,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha256'
state: present
- name: Set secure Ciphers
lineinfile:
path: /etc/ssh/sshd_config
insertafter: '^#RekeyLimit default none'
line: 'Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr'
state: present
- name: Set secure MACs
lineinfile:
path: /etc/ssh/sshd_config
insertafter: '^#RekeyLimit default none'
state: present
- name: Enable crypto policy when ssh version less than 9.5 & OS version is less than RHEL 9
lineinfile:
path: /etc/sysconfig/sshd
regexp: '^(#)?CRYPTO_POLICY='
line: 'CRYPTO_POLICY='
state: present
when: (SSHVER < "9.5") and (ansible_facts['distribution'] == "RedHat" and ansible_facts['distribution_major_version'] < "9")
- name: Enable crypto policy when ssh version less than 9.5 & OS version is RHEL 9
copy:
dest: /etc/ssh/sshd_config.d/10-crypto_override.conf
content: |
GSSAPIKexAlgorithms gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-
KexAlgorithms [email protected],curve25519-sha256,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha256
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]
CASignatureAlgorithms ecdsa-sha2-nistp256,[email protected],ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,[email protected],rsa-sha2-256,rsa-sha2-512
RequiredRSASize 2048
owner: root
group: root
mode: '0644'
when: (SSHVER < "9.5" and ansible_facts['distribution'] == "RedHat" and ansible_facts['distribution_major_version'] == "9")
- name: Create tmout.sh file
copy:
dest: /etc/profile.d/tmout.sh
content: |
TMOUT=900
readonly TMOUT
export TMOUT
owner: root
group: root
mode: '0744'
- name: Update banner message
copy:
dest: /etc/issue.net
content: |
#################################################################
* #
* This system is for the use of authorized users only. #
* Usage of this system monitored & recorded by system personnel.#
* #
#################################################################
owner: root
group: root
mode: '0744'
- name: Restart SSHD service
systemd:
name: sshd
state: restarted